diff --git a/imphnen-backend/src/bin/seed_roles_permissions.rs b/imphnen-backend/src/bin/seed_roles_permissions.rs index eecd956..039c7de 100644 --- a/imphnen-backend/src/bin/seed_roles_permissions.rs +++ b/imphnen-backend/src/bin/seed_roles_permissions.rs @@ -28,45 +28,8 @@ async fn main() -> Result<(), Box> { ( "f6b03f25-e416-4893-ac88-caaa690afb07", vec![ - PermissionsEnum::ReadListUsers, - PermissionsEnum::ReadDetailUsers, - PermissionsEnum::CreateUsers, - PermissionsEnum::DeleteUsers, - PermissionsEnum::UpdateUsers, - PermissionsEnum::ActivateUsers, - // Full admin permissions - PermissionsEnum::ManageAllUsers, - PermissionsEnum::ManageAllRoles, - PermissionsEnum::ManageAllPermissions, - PermissionsEnum::ManageAllTeams, - PermissionsEnum::ViewAllSensitiveData, - PermissionsEnum::AccessAdminDashboard, - PermissionsEnum::ReadListRoles, - PermissionsEnum::ReadDetailRoles, - PermissionsEnum::CreateRoles, - PermissionsEnum::DeleteRoles, - PermissionsEnum::UpdateRoles, - PermissionsEnum::ReadListPermissions, - PermissionsEnum::ReadDetailPermissions, - PermissionsEnum::CreatePermissions, - PermissionsEnum::DeletePermissions, - PermissionsEnum::UpdatePermissions, - PermissionsEnum::CreateGachaClaims, - PermissionsEnum::ReadDetailGachaClaims, - PermissionsEnum::ReadListGachaItems, - PermissionsEnum::ReadDetailGachaItems, - PermissionsEnum::CreateGachaItems, - PermissionsEnum::DeleteGachaItems, - PermissionsEnum::UpdateGachaItems, - PermissionsEnum::ReadDetailGachaRolls, - PermissionsEnum::CreateGachaRolls, - PermissionsEnum::ExecuteGachaRolls, - PermissionsEnum::ReadListMentors, - PermissionsEnum::ReadDetailMentors, - PermissionsEnum::RegisterMentors, - PermissionsEnum::UpdateMentors, - PermissionsEnum::VerifyMentors, - PermissionsEnum::DeleteMentors, + // Only Administrator permission - grants access to everything + PermissionsEnum::Administrator, ], ), ( diff --git a/imphnen-iam/src/v1/permissions/permissions_enum.rs b/imphnen-iam/src/v1/permissions/permissions_enum.rs index 10a8c10..291fffb 100644 --- a/imphnen-iam/src/v1/permissions/permissions_enum.rs +++ b/imphnen-iam/src/v1/permissions/permissions_enum.rs @@ -123,6 +123,7 @@ impl fmt::Display for PermissionsEnum { PermissionsEnum::ManageAllTeams => "Manage All Teams", PermissionsEnum::ViewAllSensitiveData => "View All Sensitive Data", PermissionsEnum::AccessAdminDashboard => "Access Admin Dashboard", + PermissionsEnum::Administrator => "Administrator", }; write!(f, "{permission_str}") } @@ -188,6 +189,7 @@ impl PermissionsEnum { PermissionsEnum::ManageAllTeams => "a3b4c5d6-7890-1234-5678-3456789012ab".to_string(), PermissionsEnum::ViewAllSensitiveData => "b4c5d6e7-8901-2345-6789-4567890123ab".to_string(), PermissionsEnum::AccessAdminDashboard => "c5d6e7f8-9012-3456-7890-5678901234ab".to_string(), + PermissionsEnum::Administrator => "administrator-permission-id-123456789".to_string(), } } @@ -256,6 +258,7 @@ impl PermissionsEnum { PermissionsEnum::ManageAllTeams, PermissionsEnum::ViewAllSensitiveData, PermissionsEnum::AccessAdminDashboard, + PermissionsEnum::Administrator, ] } } diff --git a/imphnen-middleware/src/permissions_middleware/mod.rs b/imphnen-middleware/src/permissions_middleware/mod.rs index cff2da2..ce5257e 100644 --- a/imphnen-middleware/src/permissions_middleware/mod.rs +++ b/imphnen-middleware/src/permissions_middleware/mod.rs @@ -89,7 +89,10 @@ where }; let user_permissions: Vec = user.role.permissions.into_iter().map(|p| p.name).collect(); - let allowed = permissions + + // Check if user has Administrator permission - if yes, allow access to everything + let has_administrator_permission = user_permissions.contains(&PermissionsEnum::Administrator.to_string()); + let allowed = has_administrator_permission || permissions .iter() .all(|p| user_permissions.contains(&p.to_string())); if !allowed {